SonicWALL SMA 100 Series Quick reference guide

Secure Mobile Access 10.2

Deployment Guide

for the SMA 100 Series

Contents

Deployment Scenarios Overview 3

Selecting a Deployment Scenario 3

SMA 210/410 Deployment Scenarios 4

Overview of Scenario A: SMA on a New DMZ 4

Overview of Scenario B: SMA on an Existing DMZ 4

Overview of Scenario C: SMA on the LAN 4

Connecting the SMA on a New DMZ 5

Connecting the SMA to the Gateway 5

Allowing a WAN to SMA Connection 5

Allowing an SMA to LAN Connection 7

Connecting the SMA on an Existing DMZ 9

Connecting the SMA to the Gateway 9

Allowing WAN to DMZ Connection 9

Allowing DMZ to LAN Connection 10

Deploying SMA on the LAN 13

Connecting the SMA to the Gateway 13

Configuring SMA to LAN Connectivity 13

Additional Configuration 16

Configuring the X0 IP Address 16

Configuring a Default Route 17

Adding a NetExtender Client Route 17

Setting Your NetExtender Address Range 19

Adding a New SMA Custom Zone 20

Testing and Troubleshooting Your Remote Connection 22

Verifying a User Connection from the Internet 22

Policy > Access Rules Matrix View 23

SonicWall Support 24

About This Document 25

SMA 10.2 Deployment Guide for the SMA 100 Series

Contents

Deployment Scenarios Overview

Welcome to the SonicWall SMA Deployment Guide. SonicWall® Secure Mobile Access 210/410 provides a

unified secure gateway to access all network and cloud resources. This guide contains configuration

guidelines for deployment scenarios involving new DMZ, existing DMZ, and LAN deployments, along with

basic configuration settings for those scenarios.

Topics:

lSelecting a Deployment Scenario

lSMA 210/410 Deployment Scenarios

Selecting a Deployment Scenario

The deployment scenarios described in this guide are based on actual customer deployments and are

SonicWall-recommended deployment best practices for SMA appliances.

An SMA appliance is commonly deployed in one-arm mode over the DMZ interface on an accompanying

gateway appliance, such as a SonicWall NSa 3600. This method of deployment offers additional layers of

security control, plus the ability to use SonicWall’s security services, including Gateway Anti-Virus, Anti-

Spyware, Content Filtering, Intrusion Prevention Service, and Comprehensive Anti-Spam Service, to scan all

incoming and outgoing traffic.

The primary interface (X0) on the SonicWall SMA connects to an available segment on the gateway device.

The encrypted user session is passed through the gateway to the SMA appliance. The SonicWall SMA

appliance decrypts the session and determines the requested resource.

The session traffic then traverses the gateway appliance to reach the internal network resources. The

gateway appliance applies security services as data traverses the gateway. The internal network resource

then returns the requested content to the SonicWall SMA appliance through the gateway, where it is

encrypted and sent to the client.

SMA 10.2 Deployment Guide for the SMA 100 Series

Deployment Scenarios Overview

SMA 210/410 Deployment Scenarios

Gateway Appliance Deployment Scenario Requirements on Gateway Appliance

SonicOS/X 7 or higher:

lTZ Series

lNSa Series

lNSsp Series

lNSv Series

SMA on new DMZ lAn unused interface

lNEW DMZ configured for NAT or Transparent

Mode

SMA on existing DMZ lOne dedicated interface in use as an existing

DMZ

SMA on LAN lNone

For a full list of the supported SonicWall firewall and firmware versions, see

https://www.sonicwall.com/support/product-lifecycle-tables/

The following illustrations provide an overview of each deployment scenario:

lOverview of Scenario A: SMA on a New DMZ

lOverview of Scenario B: SMA on an Existing DMZ

lOverview of Scenario C: SMA on the LAN

Overview of Scenario A: SMA on a New DMZ

Overview of Scenario B: SMA on an Existing DMZ

Overview of Scenario C: SMA on the LAN

SMA 10.2 Deployment Guide for the SMA 100 Series

Deployment Scenarios Overview

Connecting the SMA on a New DMZ

The following procedures explain how to configure your gateway appliance on a new DMZ:

lConnecting the SMA to the Gateway

lAllowing a WAN to SMA Connection

lAllowing an SMA to LAN Connection

Connecting the SMA to the Gateway

To connect the SMA 210/410 using Scenario A:

1. Connect one end of an Ethernet cable to an unused port on your SonicWall gateway appliance.

2. Connect the other end of the Ethernet cable to the X0 port on the front of your SonicWall Secure

Mobile Access 210/410. The X0 Port LED lights up indicating an active connection.

3. Configure the SMA X0 IP address. Refer to Configuring the X0 IP Address.

Allowing a WAN to SMA Connection

NOTE: Before continuing, you must add a new SMA custom zone. Refer to Adding a New SMA Custom

Zone for more information.

To allow a WAN to SMA connection:

1. Using SonicOS, click the Wizards icon in the top right corner of the gateway appliance management

interface.

2. On the Configuration Guide page, select the Public Server Guide, and then click Next.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

3. On the Public Server Guide, select these options:

Service Type Other

Services Create new group

4. In the Service Group dialog box, create a service group for HTTP and HTTPS:

lEnter a Name for the service.

lSelect both HTTP and HTTPS and click the arrow button to move them to the right column.

lClick Save.

5. On the Server Private Network Configuration page, enter the following server and SMA

information, and then click Next:

Server Name Specify the name for the SMA appliance

Server Private IP Address SMA appliance X0 IP address

Server Comment Brief description of the server

6. On the Server Public Information page, accept the default IP address, or enter an IP address in

your allowed public IP range. Click Next.

NOTE: The default IP address is the WAN IP address of your SonicWall security appliance. If

you accept this default, all HTTP and HTTPS traffic to this IP address will be routed to your SMA

appliance.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

7. The Public Server Configuration Summary page displays all the configuration actions that are

performed. Click Apply to create the configuration and allow access from the WAN to the SMA on

the DMZ.

Allowing an SMA to LAN Connection

When users have connected to the SMA, they need to be able to connect to resources on the LAN.

To allow an SMA to LAN connection:

1. Using SonicOS, navigate to the OBJECT | Match Objects > Addresses page on the gateway

appliance.

2. In the Address Objects tab, click +Add.

3. In the Address Object Settings dialog box, create an address object for the X0 interface IP address

of your SMA appliance:

Name Name of the SMA appliance

Zone Assignment SMA

Type Host

IP Address SMA appliance X0 IP address (default 192.168.200.1)

4. Click Save to create the object. Once done, click Close.

5. Click Add again to create an address object for the NetExtender range.

6. In the Add Address Object dialog box, create an address object for the NetExtender range:

Name Name for NetExtender range

Zone Assignment SMA

Type Range

Starting IP Address Start of the NetExtender IP address range (default 192.168.200.100)

Ending IP Address End of the NetExtender IP address range (default 192.168.200.200)

7. Click Save to create the object. Once added, click Close.

8. On the OBJECT | Match Objects > Addresses page, click the Address Groups tab.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

9. Click +Add.

10. In the Add Address Groups dialog box, create a group for the X0 interface IP address of your SMA

appliance and the NetExtender IP range:

lEnter a name for the group.

lIn the left column, select the address objects you created and click the right arrow button.

lClick Save to create the group when both objects are in the right column.

11. Navigate to the POLICY | Rules and Policies > Access Rules page, and select the Matrix view

style.

12. Click the SMA > LAN icon.

13. On the page that displays for SMA to LAN, click +Add.

14. In the Add Rule window, create a rule to allow access to the LAN for the address group you just

created:

Source Zone/Interface SMA

Source Destination LAN

Source Port Any

Service Any

Source The address group you just created, such as SMA and

NetExtender.

Destination Any

Users Allowed All

Users Excluded None

Schedule Always on

Select the following check box

(es)

lEnable Logging

lAllow Fragmented Packets

15. Click OK to create the rule.

This completes Scenario A.

NOTE: Some gateway appliances have a default zone named SSLVPN. Do not select this zone when

configuring for the SMA appliance. The SSLVPN zone is intended for use with the more limited SSLVPN

features that are included in the firewall products.

Continue to Additional Configuration and Testing and Troubleshooting Your Remote Connection.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on a New DMZ

Connecting the SMA on an Existing DMZ

The following procedures explain how to configure your gateway on an existing DMZ:

lConnecting the SMA to the Gateway

lAllowing WAN to DMZ Connection

lAllowing DMZ to LAN Connection

Connecting the SMA to the Gateway

To connect the SMA using Scenario B:

1. Connect one end of an Ethernet cable to your DMZ, either directly to the corresponding port on your

existing SonicWall gateway appliance, to a hub, or to a switch on your DMZ.

2. Connect the other end of the Ethernet cable to the X0 port on your SonicWall SMA 210/410. The X0

Port LED lights up indicating an active connection.

3. Configure the SMA X0 with an IP address in the DMZ subnet. Refer to Configuring the X0 IP Address

for more information.

Allowing WAN to DMZ Connection

If you are already forwarding HTTP or HTTPS to an internal server and you only have a single public IP

address, you need to select different (unique) ports of operation for either the existing servers or for the SMA

appliance, because both cannot concurrently use the same IP address and port combinations.

To allow a WAN to DMZ connection:

1. Using SonicOS, log into your gateway appliance as an administrator and click the Wizards icon at

the top right of the interface.

2. On the Configuration Guide page, select the Public Server Guide, and then click Next.

3. On the Public Server Guide page of the Wizard, select:

Server Type Other

Service Create new group

The Service Group dialog box is displayed.

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on an Existing DMZ

4. In the Service Group dialog box, create a service group for HTTP and HTTPS:

lEnter a Name for the service group.

lSelect both HTTP and HTTPS and click the arrow button to move to the right column.

lClick OK.

5. On the Server Private Network Configuration page, enter the following server information and

click Next:

Server Name Name for the SMA appliance

Server Private IP

Address

The X0 IP address of the SMA appliance within your DMZ range, such

as 10.1.1.10/24.

Server Comment Brief description of the server

6. On the Server Public Information page, accept the default IP address or enter a new IP address in

your allowed public IP range. Click Next.

NOTE: The default IP address is the WAN IP address of your SonicWall firewall. If you accept

this default, all HTTP and HTTPS traffic to this IP address is routed to your SMA appliance.

7. The Public Server Configuration Summary page displays all configuration actions that are

performed. Click Apply to create the configuration and allow access from the WAN to the SMA

appliance on the DMZ.

Allowing DMZ to LAN Connection

When users have connected to the SMA, they need to be able to connect to resources on the LAN.

To allow a DMZ to LAN connection:

1. Using SonicOS, navigate to the OBJECT | Match Objects > Addresses page on the gateway

appliance.

2. In the Address Objects tab, click +Add.

3. In the Address Object Settings dialog box, create an address object for the X0 interface IP address

of your SMA appliance:

Name Name of the SMA appliance

Zone

Assignment

DMZ

Type Host

IP Address X0 IP address of the SMA appliance within your DMZ range, such as

10.1.1.10.

4. Click OK to create the object. Once added, click Close.

5. Click +Add again to create an address object for the NetExtender range.

6. In the Add Object dialog box, create an address object for the NetExtender range using the

following options, then click Add:

Name Name for NetExtender

SMA 10.2 Deployment Guide for the SMA 100 Series

Connecting the SMA on an Existing DMZ

Other manuals for SMA 100 Series

Table of contents

Other SonicWALL Wireless Access Point manuals

SonicWALL

SonicWALL SonicWave 432o User manual

SonicWALL

SonicWALL SonicWave 432e User manual

SonicWALL

SonicWALL TZ500 W Owner's manual

SonicWALL

SonicWALL SonicWave 400 Series Quick reference guide

SonicWALL

SonicWALL SonicWave 432o User manual

SonicWALL

SonicWALL APL30-0B8 Owner's manual

SonicWALL

SonicWALL APL13-02C User manual

SonicWALL

SonicWALL SonicWave 231c User manual

SonicWALL

SonicWALL SonicWave 231o Owner's manual

SonicWALL

SonicWALL SonicWave 641 User manual

SonicWALL

SonicWALL SonicWave 224w Owner's manual

SonicWALL

SonicWALL E-Class SonicPoint-Ne User manual

SonicWALL

SonicWALL APL43-0C2 Owner's manual

SonicWALL

SonicWALL SonicWave 200 Series Quick reference guide

SonicWALL

SonicWALL SonicWave 200 Series Quick reference guide

SonicWALL

SonicWALL APL29-0B6 Owner's manual

SonicWALL

SonicWALL SonicWave 400 Series User manual

SonicWALL

SonicWALL SonicWave 681 User manual

SonicWALL

SonicWALL SonicWave 432o User manual

SonicWALL

SonicWALL TZ300P Owner's manual

SonicWALL

SonicWALL APL62-0F7 Owner's manual

SonicWALL

SonicWALL ex9000 User manual

SonicWALL

SonicWALL SonicWave 200 Series Quick reference guide

SonicWALL

SonicWALL SonicWave 432i Owner's manual

Popular Wireless Access Point manuals by other brands

D-Link

D-Link DWL-2100AP - AirPlus Xtreme G Quick installation guide

Ubiquiti

Ubiquiti NanoStation NSM2 quick start guide

Cisco

Cisco Aironet 1550 Series Getting started guide

Aruba

Aruba IAP-335 user guide

Advantek Networks

Advantek Networks AWN-AP-54MR user manual

IP-COM

IP-COM AP355 user guide

Buffalo

Buffalo AirStation WLA-L11G user manual

EnGenius

EnGenius EnStationACv2 user manual

D-Link

D-Link DAP-3662 Quick installation guide

xG Technology

xG Technology xMax CN1300 installation guide

Widelink

Widelink ezWave WAP-1100 Series user guide

Edimax

Edimax CAP1200 user manual

Ubiquiti

Ubiquiti LBE-5AC-Gen2 quick start guide

Aruba

Aruba AP-203R installation guide

LuXout Shades

LuXout Shades LUXSHADE MOTION manual

CreatComm

CreatComm TB5F user manual

SineDigital

SineDigital MW-1500AP(H) installation guide

TP-Link

TP-Link AP9650 V1 Quick installation guide